Suspicious Invocation of Shell via AWK - Linux

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•2•0•22

Detects the execution of 'awk' or its sibling commands (gawk, mawk, nawk) to invoke a shell using the `system()` function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.